This invention relates generally to the field of cryptography and more specifically to preventing the breaking of a cryptographic system""s private key through the use of power-monitoring and timing-monitoring techniques.
Recently, it has been discovered that cryptographic key information can be obtained from a secure processor by monitoring the time it takes the processor to perform coding and/or decoding operations. In addition, monitoring the power during the course of such operations can be used as a way to attack the processor""s security. For example, this can occur when the functions of multiplication and squaring utilize different amounts of time and power. Thus, an individual who is mounting an attack can break a private key by tracking the amount of time and power required for many different messages input to a secure device. Being able to watch power use and time use eventually can reveal the key.
Although countermeasures exist to combat discerning keys by power or timing attacks, these countermeasures have not produced a technique that is effective against both types of monitoring. Also, the use of these countermeasures can require large amounts of memory, processor cycles, additional circuitry, power, or other resources. This is unacceptable, for example, when the secure processor is in a power-limited environment such as in a battery-powered xe2x80x9csmart cardxe2x80x9d where power, speed, and available surface area for circuitry are important.
Thus, it is desirable to provide a countermeasure technique that works effectively against both power and timing monitoring attacks while still having a low resource requirement. It is also desirable to counter these power and timing attacks while incurring a limited performance penalty.
The present invention uses emulated cryptographic operations to disguise time usage and/or power usage by a cryptography system. For example, one embodiment of the invention performs unnecessary mathematical operations and/or unnecessary storage of data in order to disguise whether a mathematical operation or store actually took place in an algorithm. The total number of emulated operations can be controlled so that the power and processor cycle time used by the emulated multiplies remains efficient.
In one embodiment, the invention provides a method of disguising power usage and time usage in a processing system that uses a private key to perform cryptographic operations. The processor performs emulated multiply operation(s) in order to mask one or more bits of the key. This embodiment of the invention can be advantageous in that it disguises whether the key dictated that a multiply operation should or should not be performed. Because of the unnecessary multiply operation, an attacker sees unpredictable time usage and similar power usage regardless of the value of the bit in the key. Hence, the value of the key is maintained as secure. As a further act, the result of the emulated multiplication can be stored to a dummy memory locationxe2x80x94which further emulates the procedure followed when a necessary multiplication/store feature is dictated by the key.
Further advantages and features of the invention will be apparent to those skilled in the art from a consideration of the following description taken in conjunction with the accompanying drawings. It is understood that the invention is not limited to the details disclosed, but rather, includes all such variations and modifications that fall within the spirit of the invention and scope of the appended claims.